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Abstract. We describe a tabulation of (conjecturally) modular elliptic curves 
over the field (Q(\/5) up to the first curve of rank 2. Using an efficient imple- 
mentation of an algorithm of Lassina Dembele |Dem05] . we computed tables 
of Hilbert modular forms of weight (2, 2) over Q{V5), and via a variety of 
methods we constructed corresponding elliptic curves, including (again, con- 
jecturally) all elliptic curves over Q{\/5) that have conductor with norm less 
than or equal to 1831. 



1. Introduction 

1.1. Elliptic Curves over Q. Tables of elliptic curves over Q have been of great 
value in mathematical research. Some of the first such tables were those in Antwerp 
IV jBK75j . which included all elliptic curves over Q of conductor up to 200, and 
also a table of all elliptic curves with bad reduction only at 2 and 3. 

Cremona's book jCre97] gives a detailed description of algorithms that together 
output a list of all elliptic curves over Q of any given conductor, along with extensive 
data about each curve. The proof that his algorithm outputs all curves of given 
conductor had to wait for the proof of the full modularity theorem in [BCDTOTj . 
Cremona has subsequently computed tables |Crej of all elliptic curves over Q of 
conductor up to 220,000, including Mordell-Weil groups and other extensive data 
about each curve; he expects to soon reach his current target, conductor 234,446, 
which is the smallest known conductor of a rank 4 curve. 

In a different direction. Stein- Watkins (see |SW02| IBMSWOTj ) created a table 
of 136,832,795 elliptic curves over Q of conductor < 10®, and a table of 11,378,911 
elliptic curves over Q of prime conductor < 10^°. There are many curves of large 
discriminant missing from the Stein- Watkins tables, since these tables are made by 
enumerating curves with relatively small defining equations, and discarding those 
of large conductor, rather than systematically finding all curves of given conductor 
no matter how large the defining equation. 

1.2. Why Q(V5)? Like Q, the field F ^ Q(\/5) is a totally real field, and many 
of the theorems and ideas about elliptic curves over Q have been generalized to 
totally real fields. As is the case over Q, there is a notion of modularity of elliptic 
curves over F, and work of Zhang |Zha01j has extended many results of Gross- 
Zagier |GZ86| and Kolyvagin |Kol91j to the context of elliptic curves over totally 
real fields. 
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If we order totally real number fields K by the absolute value of their discrim- 
inant, then F = Q(-\/5) comes next after Q (the Minkowski bound implies that 
\Dk\ > (n"/n!)2, where n = [if : Q], so if n > 3 then \Dk\ > 20). That 5 divides 
disc(i^) = 5 thwarts attempts to easily generalize the method of Taylor- Wiles to 
elliptic curves over F, which makes Q(-\/5) even more interesting. The field F also 
has 31 CM j-invariants, which is far more than any other quadratic field (see Sec- 
tion[5l). Letting if = , we have that the group of units {±1} x {ip) of the ring 
R — Op = of integers of F is infinite, leading to additional complications. 
Finally, F has even degree, which makes certain computations more difficult, as 
the cohomological techniques of |GVllj are not available. 

1.3. Modularity conjecture. The following conjecture is open: 

Conjecture 1.1 (Modularity). The set of L-functions of elliptic curves over F 
equals the set of L-functions associated to cuspidal Hilbert modular newforms over 
F of weight (2, 2) with rational Hecke eigenvalues. 

Given the progress on modularity theorems initiated by |Wil95j . we are opti- 
mistic that Conjecture 11.11 will be proved. We officially assume Conjecture \1.1\ for 
the rest of this paper. 

In Section [5] we sketch how to compute Hilbert modular forms using arithmetic 
in quaternion algebras. Section |3] gives numerous methods for finding an elliptic 
curve corresponding to a Hilbert modular form. Section |4] addresses how to find 
all curves that are isogenous to a given curve. In Section [5] we enumerate the CM 
j-invariants in F. We discuss some projects for future work in Section |6l Finally, 
Section [7] contains tables that summarize various information about our dataset 
jBDKM+12| . 

Acknowledgements. We would like to thank John Cremona, Tom Fisher, 
Noam Elkies, Richard Taylor, and John Voight for helpful conversations. We would 
especially like to thank Joanna Gaski for providing (via the method of Section 13. ip 
the explicit table of elliptic curves that kickstarted this project. We used Sage 



S"'"12| extensively throughout this project. 



2. Computing Hilbert modular forms over F 



In Section r2.1l we sketch Dembele's approach to computing Hilbert modular forms 
over F, then in Section [2. 2 1 we make some remarks about our fast implementation. 



2.1. Hilbert modular forms and quaternion algebras. Dembele |Dem05| in- 
troduced an algebraic approach via the Jacquet-Langlands correspondence to com- 
puting Hilbert modular forms of weight (2, 2) over F. The Hamiltonian quaternion 
algebra F[i,j, k] over F is ramified exactly at the two infinite places, and contains 
the maximal order 



S = R 



i(l -(pi + (fj), ^{-fi+j + (pk), ^{(fii - Lpj + k), i(i + (fj - ipk) 



For any nonzero ideal n in i? = Oj?, let P^(i?/n) be the set of equivalence classes of 
column vectors with two coprime entries a, & € R/n modulo the action of {R/n)*. 
We use the notation [a : b] to denote the equivalence class of ( ^ ) . For each prime 
p I n, we fix a choice of isomorphism F[i,j,k\ (g) Fp « M2{F^), which induces a 
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left action of S* on P^(i?/n). The Jacquet-Langlands correspondence implies that 
the space of Hilbert modular forms of level n and weight (2, 2) is noncanonically 
isomorphic as a module over the Hecke algebra 

T = Z[rp : p nonzero prime ideal of R] 

to the finite dimensional complex vector space V = C[5*\P^(i?/n)]. The action of 
Tp, for p f n, is Tp([x]) = ^[aa;], where the sum is over the classes [a] £ S/S* 
with A'iod(a) = TTp (reduced quaternion norm), where TTp is a fixed choice of totally 
positive generator of p. 

2.2. Remarks on Computing with P^(i?/n). In order to implement the algo- 
rithm sketched in Section [^TTl it is critical that we can compute with P^(i?/n) very, 
very quickly. For example, to apply the method of Section [5T71 below, in some cases 
we have to compute tens of thousands of Hecke operators. Thus in this section we 
make some additional remarks about this fast implementation. 

When n = p*^ is a prime power, it is straightforward to efficiently enumerate 
representative elements of P^(i?/p'^), since each element [x : y] of P^(i?/p^) has a 
unique representative of the form [1 : b] or [a : 1] with a divisible by p, and these 
are all distinct. It is easy to put any [x : y] in this canonical form and enumerate 
the elements of P^(i?/p'^), after choosing a way to enumerate the elements of i?/p'^. 
An enumeration of i?/p^ is easy to give once we decide on how to represent R/p^- 

In general, factor n = J]" i ■ We have a bijection F^{R/n) ^ J]™ i PH-R/pD' 
which allows us to reduce to the prime power case, at the expense of having to 
compute the bijection i?/n = J^i?/p^'. To this end, we represent elements oi R/n 
as m-tuples in ri^/Pi% thus making computation of the bijection trivial. 

To minimize dynamic memory allocation, thus speeding up the code by an order 
of magnitude, in the implementation we make some arbitrary bounds; this is not 
a serious constraint, since the linear algebra needed to isolate eigenforms for levels 
beyond this bound is prohibitive. We assume m < 16 and each individual p^' < 2^^, 
where pi is the residue characteristic of pi. In all cases, we represent an element 
of R/p1^ as a pair of 64-bit integers, and represent an element of R/n as an array 
of 16 pairs of 64-bit integers. We use this representation in all cases, even if n is 
divisible by less than 16 primes; the gain in speed coming from avoiding dynamic 
memory allocation more than compensates for the wasted memory. 

Let p'^ be one of the prime power factors of n, and let p be the residue charac- 
teristic of p. We have one of the following cases: 

• p splits in R\ then R/p = Z/pZ and we represent elements of R/p'^ as pairs 
(a, 0) mod p'^ with the usual addition and multiplication in the first factor. 

• p is inert in i?; then R/p^' = (Z/p'^Z)[a;]/(a;^ — x — 1), and we represent 
elements by pairs (a, h) G Z/p'^Z with multiplication 

(a, &)(c, d) = (ac + fed, ad + bd + be) mod p'^. 

• p is ramified and e = 2/ is even; this is exactly the same as the case when 
p is inert but with e replaced by /, since R/p'^R = {Z / p^ Z)[x] / {x'^ — a; — 1). 

• p is ramified (so p = 5) and e = 2/ — 1 is odd; the ring A = R/p'^ is trickier 
than the rest, because it is not of the form Z[x]/{m, g) where m € Z and 
g £ Z[x]. We have A {Z/5-fZ)[x]/{x'^ — 5, and represent elements 
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of A as pairs (a, 6) G (Z/5-^) x (Z/5^ ""^Z), with arithmetic given by 

{a,b) + {c,d) = (a + c mod 5-'', b + d mod 5-''""'^) 
{a,b) ■ {c,d) ^ (ac + bbd mod 5-'^, ad + bc mod 5-^"^). 

Wc find that ip eR^ {1/2, 1/2). 

3. Strategies for finding an elliptic curve attached to a Hilbert 

modular form 

In this section we describe various strategies to find an ehiptic curve associated 
to each of the Hilbert modular forms computed in Section 2. Let / be a rational 
cuspidal Hilbert newform of weight (2, 2) as in Section [21 According to Conjec- 
ture ll.ll there is some elliptic curve Ef over F such that L{f, s) = L{Ef, s). (Note 
that Ef is only well defined up to isogeny.) Unlike the case for elliptic curves over 
Q (see }Cre97| ). there seems to be no known efficAent direct algorithm to find Ef. 
Nonetheless, there are several approaches coming from various directions, which 
are each efficient in some cases. 

Everywhere below, we continue to assume that Coniccturc ll.ll is true and assume 
that we have computed (as in Section[2|) the Heckc eigenvalues Op € Z of all rational 
Hilbert newforms of some level n, for Norm(p) < B a good prime, where B is large 
enough to distinguish newforms. In some cases we will need far more Op in order 
to compute with the L-function attached to a newform. We will also need the ap 
for bad p in a few cases, which we obtain using the functional equation for the 
L-function (as an application of Dokchitser's algorithm |Dok04| ) . 

We define the norm conductor of an elliptic curve over F to be the absolute norm 
of the conductor ideal of the curve. 

In Scction rS.ll wc give a very simple enumeration method for finding curves, then 
in Section 13.21 we refine it by taking into account point counts modulo primes; to- 
gether, these two methods found a substantial fraction of our curves. Sections 13.31 
and 13.41 describe methods for searching in certain families of curves, e.g., curves 
with a torsion point of given order or curves with a given irreducible mod £ Ga- 
lois representation. Section 13.51 is about how to find all twists of a curve with 
bounded norm conductor. In Section 13.61 we mention the Cremona-Lingham algo- 
rithm, which relies on computing all S'-integral points on many auxiliary curves. 
Finally, Section 13.71 explains in detail an algorithm of Dembele that uses explicit 
computations with special values of L-functions to find curves. 

3.1. Extremely naive enumeration. The most naive strategy is to systemati- 
cally enumerate elliptic curves E : = + ax + b, with a,b ^ R, and for each 
E, to compute ap{E) for p not dividing Disc(£^) by counting points on E reduced 
modulo p. If all the ap{E) match with those of the input newform / up to the 
bound B, we then compute the conductor ris, and if it equals n, we conclude from 
the sufficient largeness of B that E is in the isogeny class oi Ef. 

Under our hypotheses, this approach provides a deterministic and terminating 
algorithm to find all Ef. However, it can be extremely slow when n is small but 
the simplest curve in the isogeny class of Ef has large coefficients. For example, 
using this search method it would be infcasiblc to find the curve p.ip computed by 
Fisher using the visibility of IH[7]. 
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3.2. Sieved enumeration. A refinement to the approach discussed above uses the 
ap values to impose congruence conditions modulo p on j^E{R/p). If / is a newform 
with Hecke eigenvalues Op, then ^Ef{R/p) = N(p) + 1 — Op. Given p not dividing 
the level n, we can find all elliptic curves modulo p with the specified number of 
points, especially when N(p) + 1 — Op has few prime factors. We impose these 
congruence conditions at multiple primes pi, use the Chinese Remainder Theorem, 
and lift the resulting curves modulo ^/(HPi) non-singular curves over R. 

While this method, like the previous one, will eventually terminate, it too is very 
ineffective if every E in the class of isogenous curves corresponding to / has large 
coefficients. However in practice, by optimally choosing the number of primes pi, 
a reasonably efficient implementation of this method can be obtained. 

3.3. Torsion families. We find elliptic curves of small conductor by specializing 
explicit parametrizations of families of elliptic curves over F having specified torsion 
subgroups. We use the parametrizations of }Kub76| . 

Theorem 3.1 (Kamienny-Najman, |KN12| ). The following is a complete list of 
torsion structures for elliptic curves over F: 

Z/mZ, 1 < m < 10, m = 12, 

Z/2ZeZ/2mZ, l<m<4, 

Z/15Z. 

Moreover, there is a unique curve with lb-torsion. 

We use the following proposition to determine in which family to search. 

Proposition 3.2. Let £ be a prime and E a curve over F. Then £ \ ^E'{F)toi for 
some curve E' in the isogeny class of E if and only if £ \ N(p) + 1 — Cp for all odd 
primes p at which E has good reduction. 

Proof. If £ I #£"(i^)tor, from the injectivity of the reduction map at good primes 
|Kat81[ Appendix], we have that £ \ #£;'(Fp) = N(p) + 1 - Op. The converse 
statement is one of the main results of |Kat81| . □ 

By applying Proposition 13.21 for all ap with p up to some bound, we can decide 
whether or not it is likely that some curve in the isogeny class of E contains an 
F-rational ^-torsion point. If this is the case, then we search over those families 
of curves with rational ^-torsion. With a relatively small search space, we thus 
find many curves with large coefficients more quickly than with the algorithm of 
Section [3.11 For example, we first found the curve E given by 

+ ipy = x^ + {27ip - 43) x + {~80ip + 128) 

with norm conductor 145 by searching for curves with torsion subgroup Z/7Z. 

3.4. Congruence families. Suppose that we are searching for a curve E and we 
already know another curve E' with E[£] sa E'[£], where £ is some prime and 
E[£] is irreducible, li £ = 7,11 then we can use techniques of Fisher |Fisl2| to 
attempt to search through the finitely many curves with mod £ Galois representation 
isomorphic to E[£]. We used this approach to find the curve E given by 



(3.1) + (fxy = .x^ + {ip ~ 1) 

(-257364^5 - 159063) x + (-75257037^3 - 46511406) 
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with conductor —38ip + 10, which has norm 1476. Given just the ap, we noticed 
that £'[7] sa E'[7], where E' has norm conductor 369, then Fisher used a Magma 



[BCP97| program to find rational points on a certain quartic surface that param- 
etrize curves with the same E'[7]. Fortunately, our curve E was amongst those 
curves. We had already found E' via a naive search, since it is given by the equa- 
tion y'^ + {(fi + l)y = + [ip — 1) + (— 2(p) x. 

3.5. Twisting. Let E be an elliptic curve F. A twist E' of is a curve over F 
that is isomorphic to E over some extension of F. A quadratic twist is a twist in 
which the extension has degree 2. We can use twisting to find curves that may 
otherwise be difficult to find as follows: starting with a known elliptic curve E of 
some (small) conductor, we compute its twists of conductor up to some bound, and 
add them to our table. 

More explicitly, if E is given hy ^ x^ + ax + h and d G F*, then the twist E'^ 
of -E by d is given by dy^ = x^ + ax + b; in particular, we may assume that d is 
square free. The following is well known: 

Proposition 3.3. Ifn is the conductor of E and d G F* is coprime to n, then the 
conductor of E"^ is divisible by d^n. 

Proof. There are choices of Weierstrass equations such that A{E'^) — 2^'^d^A{E), 
where A is the discriminant. Thus the curve E'^ has bad reduction at each prime 
that divides d, because twisting introduces a 6th power of the squarefree d into the 
discriminant, and d is coprime to A(iJ), so no change of Weierstrass equation can 
remove this 6th power. Moreover, E'^ is isomorphic to E over an extension of the 
base field, so E"^ has potentially good reduction at each prime dividing d. Thus the 
reduction at each prime dividing d is additive. The conductor is unchanged at the 
primes dividing n because of the formula relating the conductor, discriminant and 
reduction type (see |Sil92| App. C,§15]), that formation of Neron models commutes 
with unramified base change, and the fact that at the primes that divide n the 
minimal discriminant of E'^ is the same as that of E. □ 

To find all twists E'^ with norm conductor at most B, we twist E by all d of the 
form ±ip^dodi, where S e {0, 1}, do is a product of a fixed choice of generators for 
the prime divisors of n, di is a squarefree product of a fixed choice of generators of 
primes not dividing n, and |N(di)| < ^ BjC ^ where C is the norm of the product of 
the primes that exactly divide n. We know from 13.31 that this search is exhaustive. 

For example, let E be given by y'^ + xy + ipy = x^ + {—ip — 1) x'^ of con- 
ductor 5iy9 — 3 having norm 31. Following the above strategy to find twists of 
norm conductor < B .= 1831, we have C = 31 and square-free di such that 
|N((ii)| < yjBjC 7.6.... Thus dx € {1, 2, (/?, 2((5} and checking aU possibilities 
for (fi^dodi, we find the curve E~^~'^ having norm conductor 775 and the curve 
j^5ip-3 leaving norm conductor 961. Other twists have larger norm conductors, e.g., 
E"^ has norm conductor 126976 = 2^2 . 31. 

3.6. Curves with good reduction outside S. We use the algorithm of Cremona 
and Lingham from |CL07| to find all elliptic curves E having good reduction at 
primes outside of a finite set S of primes in F. This algorithm has limitations 
over a general number field K due to the difficulty of finding a generating set for 
E{K) and points on E defined over Ok- Using Cremona's Magma implementation 
of the algorithm, we found several curves not found by other methods, e.g., y^ + 
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{(f + 1) xy + y = — x"^ + {—19ip — 39) x + {—lAiip — 4) , which has norm conductor 
1331. 

3.7. Special values of twisted L-series. In [Dem08| . Lassina Dcmbclc outlines 
some methods for finding modular elliptic curves from Hilbert modular forms over 
real quadratic fields. Formally, these methods are not proven to be any better than 
a direct search procedure, as they involve making a large number of guesses, and a 
priori we do not know just how many guesses wc will need to make. And unlike other 
methods described in this paper, this method requires many Hecke eigenvalues, 
and computing these takes a lot of time. However, this method certainly works 
extremely well in many cases, and after tuning it by using large tables of curves 
that we had already computed, we are able to use it to find more curves that we 
would have had no hope of finding otherwise; we will give an example of one of 
these curves later. 

When the level n is not square. Dembclc's method relies on computing or guessing 
periods of the curve by using special values of L-functions of twists of the curve. 
In particular, the only inputs required are the level of the Hilbert modular form 
and its L-series. So we suppose that we know the level n = (N) of the form, where 
N is totally positive, and that we have sufficiently many coefficients of its L-series 

Let ai and (T2 denote the embeddings of F into the real numbers, with cri((p) ~ 
1.61803 . . .. For an elliptic curve E over F we get two associated embeddings into 
the complex numbers, and hence a pair of period lattices. We let $7^ and f2^, 
which we refer to as the periods of E, be the least real and imaginary periods 
of the lattice which come from the embedding di, and as the period lattices are 
interchanged when E is replaced with its conjugate curve, we let fii. and fl^ denote 

E E 

the least real and imaginary periods of the lattice under the embedding a2 ■ 
For ease, we write 

E E E E E E 

^E^ = Sl^r^i D,^ = il^il—. 

We refer to these numbers as the mixed periods of E. 

3.7.1. Recovering the curve from its mixed periods. If we know these mixed periods 
to sufficient precision, it is not hard to recover the curve E. Without the knowledge 
of the discriminant of the curve, we do not know the lattice type of the curve and 
its conjugate, but there are only a few possibilities for what they might be. This 
gives us a few possibilities for the j-invariant of E. Observe that a-i{j{E)) is either 
j{Ti{E)) or j{T2{E)) and fT2(j(£')) is either j{Ti{E)) or j(r2 (£■)), where 

Ti{E) = = T2iE) = - 1 + ^ 

^ ' n+ ^ 2 V 

and j(t) is the familiar 

j(r) ^ e-'^''" -f 744 + 196884e^'''"' + 21493760e^'''^ + • • • . 

We try each pair of possible embeddings for j{Ei) in turn, and recognize possibilities 
for j{E) as an algebraic number. We then construct curves E' corresponding to each 
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possibility for j{E). By computing a few ap{E), we should be able to determine 
whether we have chosen the correct j-invariant, in which case E' will be a twist of 
E. We can then recognize which twist it is in order to recover E. 

In practice, of course, as we have limited precision, and as j{E) will not be 
an algebraic integer, it may not be feasible to directly determine its exact value, 
especially if its denominator is large. 

To get around the problem of limited precision, wc suppose that we have some 
extra information; namely, the discriminant A^; of the curve we are looking for. 
With A^; in hand we can directly determine which r to choose: if cti(A£;) > 
then aiijiE)) = jin{E)), and if aiiAs) < then ai{j{E)) = jir^^E)), and 
similarly for a-i. We then compute a\{c^{Ey) = (7(t)cti (A^))^/^ and a2{ci{E)) = 

(j(r')^2(A£;))V3. 

Using the approximations of the two embeddings of C4, we can recognize C4 
approximately as an algebraic integer. Specifically, we compute 

(Ti(c4) + (T2(C4) J „ Cri(c4) - 0-2(04) 

a = and p = = . 

2 2^/5 

Then C4 = a + /3\/5, and we can find cg. 

In practice, there are two important difficulties we must overcome: we do not 
know Ae and it may be quite difficult to get high precision approximations to the 
mixed periods, and thus wc may not be able to easily compute C4. Thus, we actually 
proceed by choosing a Aguoss from which we compute half-integers a and 13 and 
an integer a + b(p ^ a + /3a/5, arbitrarily rounding either a or & if necessary. We 
then make some choice of search range M, and for each pair of integers m and ri, 
bounded in absolute value by M , we try each C4. guess = (a + m) + (6 + n)Lp. 

Given C4, guess, we attempt to solve 



C6, guess — C4 g^(,gg 1728Aguess, 

and, if we can, we use these to construct a curve -Egucss- If Egress has the correct 
conductor and the correct Hecke eigenvalues, we declare that we have found the 
correct curve; otherwise, wc proceed to the next guess. 

For a choice of Aguoss, wc will generally start with the conductor Ne, and then 
continue by trying unit multiples and by adding in powers of factors of Ne- 



3.7.2. Guessing the mixed periods. Wc have thus far ignored the issue of actu- 
ally finding the mixed periods of the curve that we are looking for. Finding 
them presents an extra difficulty as our procedure involves even more guesswork. 
Dembele's idea is to use special values of twists of the L-function L{f,s). Specif- 
ically, we twist by primitive quadratic Dirichlet characters over Op, which are 
homomorphisms x ■ (C'f/c)* ±1, pulled back to Of- 

In the case of odd prime conductor, which we will stick to here, there is just 
a single primitive quadratic character, which is the quadratic residue symbol. A 
simple way to compute it is by making a table of squares, or by choosing a primitive 
root of 5 e (Of/c)*, assigning x(ff) = ~1, ^-nd again making a table by extending 
multiplicativcly. Alternatively, one could use a reciprocity formula as described in 
[BSlOj . For general conductor, one can compute with products of characters having 
prime conductor. 
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For a given / and a primitive x, we can construct the twisted L-function 

X("^)am 



mCOp ^ ' 



where m is a totally positive generator of m. (Note that x is not well defined 
on ideals, but is well defined on totally positive generators of ideals.) L(/, x, s) 
will satisfy a functional equation similar to that of L{f,s), but the conductor is 
multiplied by Norm(c)^ and the sign is multiplied by xi~N)- The key to finding 
the mixed periods of E is contained in the following conjecture that Dembele has 
distilled from jBDG04| . and we have stated specifically for 



Conjecture 3.4. If x 'is a primitive quadratic character with conductor c relatively 
prime to the conductor of E, with xif) = s' and x(l — if) = s, (where s,s' G 
{+,-} = {±1};, then 

n'/ =c^Tix)LiE,x,l)V5, 
for some integer c^, where t(x) is the Gauss sum 

t{x) = ^ x(a)exp ^27riTr ^Q;/m%/5^^ , 

a mod c 

with m a totally positive generator of c. 

Remark 3.5. The Gauss sum is more innocuous than it seems. For odd conductor 



c it is of size ■\/Norm(c), while for an even conductor it is of size ■\/2 Norm(c). Its 
sign is a 4-th root of unity, and whether it is real or imaginary can be deduced 
directly from the conjecture, as it matches with the sign of fi^* . In particular, 
t(x) is real when x(~l) = 1 ^-nd imaginary when = ~li which is a condition 

on Norm(c) mod 4, as x(— 1) = Norm(c) (mod 4). This can all be deduced, for 
example, from |BS10| . 

Also, note that Dembele writes this conjecture with an additional factor of 47r^; 
this factor does not occur with the definition of £(/, s) that we have given. 

Remark 3.6. Contained in this conjecture is the obstruction to carrying out the 
method described here when n is a square. In this case, the sign of L[f, x, s) will be 
completely determined by whether or not x{^) = x(l ~ f)i so we can only obtain 
information about either SI and or ^ and , and we need three of 
these values to find E. 

With this conjecture in place, we can describe a method for guessing the mixed 
periods of E. Now, to proceed, we construct four lists of characters up to some 
conductor bound M (we are restricting to odd prime modulus here for simplicity, 
as primitivity is ensured, but this is not necessary): 

S"-"' ^ {x mod p : x(<^) = s', x(l - <p) = s, (p, n) = 1, Norm(p) < M, xi'N) = es}. 

Here s,s' E {+,—} = ±1 again. We will consider these lists to be ordered by 
the norms of the conductors of the characters in increasing order, and index their 
elements as Xo'^ , Xi ' ■, xi" i ■ • •■ For each character we compute the central value 
of the twisted i-function to get four new lists 

C^'^' = {*-V5Norm(p)i(£;,x, 1),X G S^'^'} = {C'/ Xi''. ■ ■ ■}• 
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These numbers should now all be integer multiples of the mixed periods, so to get 
an idea of which integer multiples they might be, we compute each of the ratios 



r'^-s c s s' 

-0-^ = -^eQ, fc = l,2,.. 



attempt to recognize these as rational numbers, and choose as an initial guess 
^E„ = ^0 f Icm I numerator ( ^ j , fc = 1, 2, . . . I j . 



3.7.3. An example. We give an example of an elliptic curve that we were only able 
to find by using this method. At level n = {—38ip + 26) we found a newform /, 
computed 

a(2)(/) = -1, a(-2ip+i)(/) = 1, a(3)(/) = -1, 

a(--3y+i)(/) = ~1) a(_3y+2)(/) = -6, • • • , 0(200^-101) (/) = 168 

and determined, by examining the L-function, that the sign of the functional equa- 
tion should be —1. (In fact, we do not really need to know the sign of the functional 
equation, as we would quickly determine that +1 is wrong when attempting to find 
the mixed periods.) Computing the sets of characters described above, and choosing 
the first 3 of each, we have 

S = {X(v+6): X(7), X(7¥>-4)}, 5"+ = {X(-3y+l),X(5ip-2),X(<p-9)} 

= {X(-4i^+3)7 X(5>p-3)> X(-2i/3+13)} "S*^^ = {X(i^+9)i X(9ip-5)j X((p+13)}- 

By using the 5133 eigenvalues above as input to Rubinstein's Icalc [Rubllj . we 
compute the lists of approximate values 

£— = {-33.5784397862407,-3.73093775400387,-18.6546887691646} 
£-+ = {18.2648617736017i,32.876751192483H, 3.652972354216330 
C+- = {41.4805656925342i,8.29611313850694i,41.4805677827298i} 
C++ = {32.4909970742969, 162.454985515474, 162.454973589303}. 

Note that Icalc will warn us that we do not have enough coefficients to obtain good 
accuracy, and we make no claim as far as the accuracy of these values is concerned. 
Hoping that the ends will justify the means, we proceed forward. 

Dividing each list by the first entry, and recognizing the quotients as rational 
numbers, we get the lists 

{1.000, 9.00000000005519, 1.80000000009351} « {1,9, 9/5} 
{1.000, 0.555555555555555, 5.00000000068986} w {1, 5/9, 5} 
{1.000, 4.99999999999994, 0.999999949610245} w {1, 5, 1} 
{1.000, 0.199999999822733, 0.200000014505165} « {1,1/5, 1/5}, 
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which may give an indication of the accuracy of our values. We now proceed with 

the guesses 

^B^^uoss ~ -33.5784397862407/9 w - 3.73093775402141 

^iitgucss ~ 18.2648617736017V5 ~ 3.65297235472034^ 

^eTsucss ~ 41.4805656925342^/5 « 8.29611313850683^ 

^fii^ucss ~ 32.4909970742969 = 32.4909970742969. 

These cannot possibly be all correct, as r2^~r2^~'' = fi^^fi^". Still, we can choose 
any three and get a reasonable guess, and in fact we may choose all possible triples, 
dividing some of the guesses by small rational numbers, and choosing the fourth 
guess to be consistent with the first three; we build a list of possible embeddings 
of j{E), which will contain the possibility (Ti{j{E)) w 1.365554233954 x 10^^ 
cT2(j(-E')) « 221270.95861123, which is a possibility if 

O — y — O — ^ 0^ — — — -E, guess ^++ _ g, guess 

"B — "b, guess' "B — "B, guess' "B — 2 ' ^ 8 

Cycling through many discriminants, we eventually try 

Aguess = '^-25-(19</5-13), 

which leads us to the guess 

O'l(c4,guoss) = (fi (j(£^))cri(Aguoss))^/^ ~ 107850.372979378 
(T2(c4,guess) = (a2(j(£;))a2(Aguess))'/^ ~ 476.625892034286. 

We have enough precision to easily recognize this as 

108327 + 48019^/5 
C4,guess = ^ — = 48019</J + 30154, 

and 



'^4, guess 1728Aguoss 



does in fact have two square roots: ±(15835084(/3 + 9796985). We try both of them, 
and the choice with the minus sign gives the curve 

+ ipxy + ipy = + {ip-l)x^ + (-1001(^ - 628) x + (17899(^ + 11079) , 

which has the correct conductor. We compute a few values of Op for this curve, and 
it turns out to be the one that we are looking for. 

4. Enumerating the curves in an isogeny class 

Given an elliptic curve E/F, we wish to find representative isomorphism classes 
for all elliptic curves E' /F that are isogenous to E via an isogeny defined over F. 
The analogue of this problem over Q has an algorithmic solution as explained in 
|Cre97[ §3.8]; it relies on: 

(1) Mazur's theorem |Maz78j that if -0 : ii ^ £" is a Q-rational isogeny of 
prime degree, then deg('0) < 163. 

(2) Formulas of Vein jVel71| that provide a way to explicitly enumerate all p- 
isogenies (if any) with domain E. Vein's formulas are valid for any number 
field, but so far there has not been an explicit generalization of Mazur's 
theorem for any number field other than Q. 
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Remark 4.1. Assume the generalized Riemann hypothesis. Then work of Larson- 
Vaintrob from [LV" imphes that there is an effectively computable constant Cf such 
that any prime degree isogeny over F has degree at most Cp- 

Since we are interested in specific isogeny classes, we can use the algorithm 
described in [Billl] that takes as input a specific non-CM elliptic curve E over a 
number field if, and outputs a provably finite list of primes p such that E might 
have a p-isogeny. The algorithm is particularly easy to implement in the case when 
if is a quadratic field, as explained in |BillH §2.3.4]. Using this algorithm combined 
with Vein's formulas, we were able to enumerate all isomorphism classes of curves 
isogenous to the curves we found via the methods of Section [31 and thus divide our 
curves up into isogeny classes. 



In this section we make some general remarks about CM elliptic curves over F . 
The main surprise is that there are 31 distinct Q-isomorphism classes of CM elliptic 
curves defined over F ^ more than for any other quadratic field. 

Proposition 5.1. The field F has more isomorphism classes of CM elliptic curves 
than any other quadratic field. 

Proof. Let if be a quadratic extension of Q. Let Hd denote the Hilbert class 
polynomial of the CM order Od oi discriminant D, so Hjj E Q[X] is the min- 
imal polynomial of the j-invariant jr) of any elliptic curve E = Eu with CM 
by Od- Since K is Galois, we have jn £ K if and only if Hd is cither lin- 
ear or quadratic with both roots in K. The D for which Hd is linear are the 
thirteen va lues -3 , -4, -7, -8,-11, -12, -16, -19, -27, -28, -43, -67,-163. Ac- 
cording to |Cre92| . the D for which Hd is quadratic are the following 29 discrimi- 
nants: 



By computing discriminants of these Hilbert class polynomials, we obtain the 
following table: 



5. CM ELLIPTIC CURVES OVER F 



- 15, -20, -24, -32, -35, -36, -40, -48, -51, -52, -60, 

- 64, -72, -75, -88, -91, -99, -100, -112, -115, -123, 

- 147, -148,-187, -232, -235, -267, -403, -427. 



Field 



D so Hd has roots in field 



Field 



D so Hd has roots in field 



Q{V2) 
Q(V3) 



24, 
36, 
15, 
75, 
72 



32,-64,-88 
48 

20,-35,-40,-60, 
100,-115,-235 




Q 
Q 
Q 
Q 
Q 
Q 



V29) 
V33) 
V37) 

ViT) 
Vel) 

V89) 



232 



Q(V6) 

Q{V7) 
Q(vT7) 



52, 
51, 



112 



91,-403 
187 



99 

148 

123 

427 

267 



The claim follows because the Q(V5) row is largest, containing 9 entries. There are 
thus 31 2 • 9 + 13 distinct CM j-invariants in Q(\/5). 

□ 
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6. Related future projects 

It would be natural to extend the tables to the first known curve of rank 3 over 
F, which may be the curve y'^ + y = x'^ — 2x + 1 oi norm conductor 163^ = 26569. 
It would also be interesting to make a table in the style of |SW02| . and compute 
analytic ranks of the large number of curves that we would find; this would benefit 
from Sutherland's small jac program, which has very fast code for computing L- 
series coefficients. Some aspects of the tables could also be generalized to modular 
abelian varieties Af attached to Hilbert modular newforms with not-necessarily- 
rational Hecke eigenvalues; in particular, we could enumerate the Ay up to some 
norm conductor, and numerically compute their analytic ranks. 

7. Tables 

As explained in Sections [3] and 21 assuming Coniecture ll.il we found the complete 
list of elliptic curves with norm conductor up to 1831, which is the first norm 
conductor of a rank 2 curve over F. The complete dataset can be downloaded from 
[BDKM+12| . 

In each of the following tables #isom refers to the number of curves, #isog refers 
to the number of classes, n refers to the conductor of the given elliptic curve, and 
Weierstrass equations are given in the form [01,02,03,04,06]. 

Table 17.11 gives the number of curves and isogeny classes we found. Note that 
in these counts we do not exclude conjugate curves, i.e., if a denotes the nontrivial 
element of Gal(F/Q), then we count E and E'^ separately if they are not isomorphic. 



Table 7.1. Curves over Q(\/5) 



rank 


#isog 


#isom 


smallest Norm(n) 





745 


2174 


31 


1 


667 


1192 


199 


2 


2 


2 


1831 


total 


1414 


3368 





Table 17.21 gives counts of the number of isogeny classes of curves in our data of 
each size; note that we find some isogeny classes of cardinality 10, which is bigger 
than what one observes with elliptic curves over Q. 



Table 7.2. Number of Isogeny classes of a given size 











size 










bound 


1 


2 


3 


4 


6 


8 


10 


total 


199 


2 


21 


3 


20 


8 


9 


1 


64 


1831 


498 


530 


36 


243 


66 


38 


3 


1414 
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Table 17.31 gives the number of curves and classes up to a given norm conductor 
bound. Note that the first curve of rank 1 has norm conductor 199, and there are 
no curves of norm conductor 200. 

Table 7.3. Counts of classes and curves with bounded norm con- 
ductors and specified ranks 



#isog #isom 



rank rank 



bound 





1 


2 


total 





1 


2 


total 


200 


62 


2 





64 


257 


6 





263 


400 


151 


32 





183 


580 


59 





639 


600 


246 


94 





340 


827 


155 





982 


800 


334 


172 





506 


1085 


285 





1370 


1000 


395 


237 





632 


1247 


399 





1646 


1200 


492 


321 





813 


1484 


551 





2035 


1400 


574 


411 





985 


1731 


723 





2454 


1600 


669 


531 





1200 


1970 


972 





2942 


1800 


729 


655 





1384 


2128 


1178 





3306 


1831 


745 


667 


2 


1414 


2174 


1192 


2 


3368 



Table 17.41 gives the number of curves and classes with isogenies of each degree; 
note that we do not see all possible isogeny degrees. For example, the elliptic curve 
Xo(19) has rank 1 over F, so there are infinitely many curves over F with degree 
19 isogenies (unlike over Q where Xo{19) has rank 0). We also give an example 
curve (that need not have minimal conductor) with an isogeny of the given degree. 



Table 7.4. Isogeny degrees 



degree 


#isog 


#isom 


example curve 


Norm(n) 


None 


498 


498 


[<^+ 1,1,1,0,0] 


991 


2 


652 


2298 


[V^,-(P + 1, 0,-4, 3(^-5] 


99 


3 


289 


950 


[ip, -ip,if, -2>fi - 2,2if + 1] 


1004 


5 


65 


158 


[1,0,0,-28,272] 


900 


7 


19 


38 


[0,(p + l,tp + l,(p — I, -3(p - 


- 3] 1025 



Table [TTSI gives the number of curves with each torsion structure, along with an 
example curve (again, not necessarily with minimal conductor) with that torsion 
structure. 
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Table 7.5. Torsion subgroups 



structure 


#isom 


example curve 


JNorm(nj 


1 




296 


[0,-1,1,-8,-7] 


225 


Z/2Z 




1453 


[v, -l,0,-(p- l,<y5-3] 


164 


Z/3Z 




202 


[1,0,1,-1,-2] 


100 


Z/4Z 




243 


[(^ + 1,^-1,^,0,0] 


79 


'L/2'l(S 


)Z/2Z 


312 


[0,^ + l,0,¥>,0] 


256 


Z/5Z 




56 


[1,1,1,22,-9] 


100 


Z/6Z 




183 


[1,^,1,^-1,0] 


55 


Z/7Z 




13 


[0,1^- l,(y5+ 1,0, -VS] 


41 


Z/8Z 




21 


[1,^3+ l,(p,.^,0] 


31 


Z/2Z6 


>Z/4Z 


51 


[(^ + 1,0,0,-4,-3(^-2] 


99 


Z/9Z 




6 


[(/.,-(/? + 1,1, -1,0] 


76 


Z/IOZ 




12 


[</5 + l,l^,(/3,0,0] 


36 


Z/12Z 




6 


[(^,^ + l,0,2^-3,-(^ + 2] 


220 


Z/2Ze Z/6Z 


11 


[0,1,0,-1,0] 


80 


Z/15Z 




1 


[1,1,1,-3,1] 


100 


Z/2Z6 


. Z/8Z 


2 


[1,1,1,-5,2] 


45 



We computed the invariants in the Birch and Swinnerton-Dyer conjecture for 
our curves, and solved for the conjectural order of III; Table [7761 gives the number 
of curves in our data having each order of 111 as well as a minimal conductor curve 
exhibiting each of these orders. 



Table 7.6. m 



#m 


#isom 


first curve having #111 


Norm(n) 


1 


3191 


[1,^ + 1,^,(^,0] 


31 


4 


84 


[1,1,1,-110,-880] 


45 


9 


43 


[ip + 1, -(ys, 1, -54686¥J - 35336, 


76 




-7490886^3- 4653177] 


16 


16 


[1, ip,ip + l, -4976733(^ - 3075797, 


45 


-6393196918(^- 3951212998] 


25 


2 


[0,-1,1,-7820,-263580] 


121 


36 


2 


[1, -ip + 1, LP, 1326667^ - 2146665, 


1580 




880354255(^- 1424443332] 
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